Hi,
I’m trying to create a Guest WiFi network on my existing infrastructure. I want to isolate it so that guest users doesn’t have access to the rest of the network (I would like to share specific devices/ip addresses to the guest network), but they will have internet.
Hardware and setup:
Main Router: CRS109-8G-1S-2HnD-IN - internet goes here, dhcp server is also here. It’s a standard Home AP config
APs: CRS109-8G-1S-2HnD-IN - the APs are connected to the main router and they are in bridge mode
Main router config:
/interface bridge
add admin-mac=xxxx auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-onlyn channel-width=20/40mhz-Ce country=xxx disabled=no \
distance=indoors frequency=2427 mode=ap-bridge ssid="XXXXX" station-roaming=enabled \
wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] name=ether2-master speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=ether8 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=\
MikroTik wpa-pre-shared-key=xxxxx wpa2-pre-shared-key=xxxxx
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,r\
omon,dude,tikapp"
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether6
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface list member
add interface=wlan1 list=discover
add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=ether6 list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=sfp1 list=discover
add interface=bridge list=discover
add interface=bridge list=mactel
add interface=bridge list=mac-winbox
add interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2-master network=192.168.88.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" connection-state=\
established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=\
established,related
add action=accept chain=forward comment="defconf: accept established,related" connection-state=\
established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=\
!dstnat connection-state=new in-interface=ether1
/ip route
add disabled=yes distance=1 gateway=xxxxxx
add disabled=yes distance=1 dst-address=192.168.87.0/24 gateway=192.168.88.17
AP configuration:
/interface bridge
add name=bridge1
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-onlyn channel-width=20/40mhz-Ce \
country=xxx disabled=no installation=indoor mode=ap-bridge ssid=\
XXXXX wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40/80mhz-eeeC \
country=xxx disabled=no frequency=auto installation=indoor mode=\
ap-bridge ssid=XXXXXX wireless-protocol=802.11 wps-mode=disabled
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik wpa-pre-shared-key=XXXX \
wpa2-pre-shared-key=XXXX
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wlan2
add bridge=bridge1 interface=wlan1
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
/ip dhcp-client
add disabled=no interface=bridge1
/system identity
set name=mt_ap_xxxx
I want to create the guest WiFi only on one of the APs, which is closer to the meeting room:
This is my planned configuration for the AP:
- Create new security profile for guest network
- Crate new virtual WiFi interface with the new security profile
- I’m stuck here
So I have a couple of questions:
- Should I create new bridge and new dhcp server on the main router or on the AP? I’m assuming these needs to be on the main route, since my current DHCP server is there
- How to configure APs virtual WiFi interface to the main router newly created bridge/dhcp server? Should I use a VLAN approach?
I’ve searched for a similar topics but I couldn’t find one that solves my problem.
Some guidance will be much appreciated, thanks!
(mistakes and typos happen).